@arnilo/prism 0.7.0 → 0.9.0

package/dist/agent-session/session/persist.js

@@ -1,5 +1,5 @@
 /** Finalize/persist phase of runInternal (plan 059). */
-import { boundedLoopSnapshot, initialAgentRunState, publicState, saveAgentRunState } from "../../agent-run-state.js";
+import { boundedLoopSnapshot, initialAgentRunState, publicState, resolveCheckpointMetadata, saveAgentRunState, } from "../../agent-run-state.js";
 import { AgentRunStateError } from "../../contracts.js";
 import { redactRunLedgerRecord } from "../../redaction.js";
 import { isFlushableRunLedger } from "../../run-ledger.js";
@@ -10,13 +10,16 @@ export async function persistDurable(session, state) {
     if (!durable)
         throw new AgentRunStateError("Durable run state is not configured");
     const withGrant = session.activeToolNames !== undefined ? { ...state, toolNames: session.activeToolNames } : state;
-    const attentionSticky = session.serializedAttentionSticky();
-    const persisted = durable.options.persistSessionState
-        ? {
-            ...withGrant,
-            sessionState: {
+    const persistSessionState = durable.options.persistSessionState === true;
+    // Plan 086 T3: durable folding owns its two keys. A run that opted into `durable` writes the
+    // fold ledger and its frontier even when the broader session-state bag stays off; a run that
+    // did not keeps exactly today's bytes, where the frontier rides `persistSessionState`.
+    const attentionSticky = persistSessionState || session.attentionDurable ? session.serializedAttentionSticky() : undefined;
+    const attentionFold = session.attentionDurable ? session.serializedAttentionFold() : undefined;
+    const sessionState = {
+        ...(persistSessionState
+            ? {
                 loadedSkillNames: session.loadedSkills.list(),
-                ...(attentionSticky ? { attentionSticky } : {}),
                 ...(session.activatedTools.list().length ? { activatedToolNames: session.activatedTools.list() } : {}),
                 ...(durable.options.includeSkillBodies
                     ? {
@@ -25,9 +28,13 @@ export async function persistDurable(session, state) {
                             : undefined),
                     }
                     : {}),
-            },
-        }
-        : withGrant;
+            }
+            : {}),
+        ...(attentionSticky ? { attentionSticky } : {}),
+        ...(attentionFold ? { attentionFold } : {}),
+    };
+    const persisted = Object.keys(sessionState).length > 0 ? { ...withGrant, sessionState } : withGrant;
+    const metadata = resolveCheckpointMetadata(durable.options.checkpointMetadata) ?? durable.checkpointMetadata;
     const saved = await saveAgentRunState({
         checkpoints: durable.options.checkpoints,
         state: persisted,
@@ -36,6 +43,7 @@ export async function persistDurable(session, state) {
         fencingToken: durable.options.fencingToken,
         redactor: session.activeRedactor,
         maxStateBytes: durable.options.maxStateBytes,
+        ...(metadata ? { metadata } : {}),
     });
     durable.state = saved.state;
     durable.version = saved.record.version;
@@ -77,8 +85,67 @@ export async function suspendDurable(session, input) {
         counters: input.limits.snapshot(),
     });
 }
+/**
+ * Turn-boundary crash-recovery checkpoint (plan 084 Task 1). Called before each provider
+ * request when `checkpointPolicy: "every-turn"`; a no-op otherwise, so default-policy runs keep
+ * the 0.8.x checkpoint shape and write count unchanged. Pending-decision markers are dropped:
+ * at a turn boundary every gated call has been resolved or the run already suspended, and a
+ * stale marker must never replay. The recorded `checkpointPolicy` makes the cadence survive
+ * into a resumed run, and loop-local state rides along exactly as it does at suspension.
+ */
+export async function checkpointDurableTurn(session, input) {
+    if (session.activeDurable?.options.checkpointPolicy !== "every-turn")
+        return;
+    await writeRunningCheckpoint(session, input);
+}
+/**
+ * Fold-boundary checkpoint (plan 086 T3). Called once per turn that added folded bodies — never
+ * per turn — when the resolved compiler is durable, so a crash after a fold resumes with the
+ * ledger and frontier already on disk. Independent of `checkpointPolicy`: the fold is the
+ * durability point that matters for a long single run, not the turn boundary.
+ */
+export async function checkpointDurableFold(session, input) {
+    if (!session.attentionDurable)
+        return;
+    await writeRunningCheckpoint(session, input);
+}
+/** Shared running-checkpoint write for the turn-boundary and fold-boundary triggers. */
+async function writeRunningCheckpoint(session, input) {
+    const durable = session.activeDurable;
+    if (!durable)
+        return;
+    const loop = session.activeLoop;
+    const loopState = loop?.snapshot ? boundedLoopSnapshot(loop.name, loop.revision ?? "1", loop.snapshot()) : undefined;
+    const state = durable.state ??
+        initialAgentRunState({
+            agent: session.agent,
+            options: durable.options,
+            runId: input.runId,
+            sessionId: session.id,
+            leafId: session.currentLeafId,
+            model: input.model,
+            counters: input.limits.snapshot(),
+            deadlineAt: input.limits.deadlineAt,
+            status: "running",
+            interruptBeforeTool: durable.options.interruptBeforeTool,
+        });
+    await persistDurable(session, {
+        ...state,
+        leafId: session.currentLeafId,
+        status: "running",
+        interruption: undefined,
+        // The input messages are already in the session store by the time a turn boundary is
+        // reached; keeping them would re-append them on a later resume.
+        input: undefined,
+        pending: undefined,
+        pendingCalls: undefined,
+        ...(loopState ? { loopState } : {}),
+        counters: input.limits.snapshot(),
+    });
+}
 export async function persistSucceeded(ctx, loopUsage) {
     const { session, runId, runUsage } = ctx;
+    const stop = ctx.runStop;
     const usage = runUsage.value() ?? loopUsage;
     if (usage && session.activeLedger) {
         const usageRecord = {
@@ -97,12 +164,15 @@ export async function persistSucceeded(ctx, loopUsage) {
         ? await persistDurable(session, {
             ...session.activeDurable.state,
             status: "succeeded",
+            // Plan 084 Task 2: a host-policy stop is terminal for the run but leaves the frontier
+            // intact — the loop state is kept and the state is marked continuable.
+            ...(stop ? { stopReason: "host_policy", leafId: session.currentLeafId } : {}),
             pending: undefined,
             pendingCalls: undefined,
             nestedRuns: undefined,
             stickyDecisions: undefined,
             interruption: undefined,
-            loopState: undefined,
+            ...(stop ? {} : { loopState: undefined }),
         })
         : undefined;
     session.emit({
@@ -111,8 +181,17 @@ export async function persistSucceeded(ctx, loopUsage) {
         runId,
         usage,
         ...(ctx.loopCtx.finishReason ? { finishReason: ctx.loopCtx.finishReason } : {}),
+        ...(stop?.detail ? { stopDetail: stop.detail } : {}),
+    });
+    const stopReason = ctx.runStop?.reason ?? ctx.loopCtx.finishReason;
+    return session.buildRunResult({
+        runId,
+        status: "succeeded",
+        usage,
+        runState,
+        ...(stopReason ? { stopReason } : {}),
+        ...(stop?.detail ? { stopDetail: stop.detail } : {}),
     });
-    return session.buildRunResult({ runId, status: "succeeded", usage, runState });
 }
 export async function cleanupRun(input) {
     const { session, controller, cleanupSignal, runId, model, startedAt, runStatus, runError } = input;
@@ -138,6 +217,8 @@ export async function cleanupRun(input) {
                 status: runStatus,
                 startedAt,
                 finishedAt: new Date().toISOString(),
+                ...(input.runStatus === "succeeded" && input.stopReason ? { stopReason: input.stopReason } : {}),
+                ...(input.runStatus === "succeeded" && input.stopDetail ? { stopDetail: input.stopDetail } : {}),
                 abortReason: controller.signal.aborted ? String(controller.signal.reason) : undefined,
                 error: runError,
                 ...(session.activePromptVersion ? { promptVersion: session.activePromptVersion } : {}),
@@ -160,6 +241,7 @@ export async function cleanupRun(input) {
         session.activeLimits?.dispose();
         session.activeToolNames = undefined;
         session.activeLimits = undefined;
+        session.activeRecentToolCalls = undefined;
         session.activeLimitOutputBuffer = false;
         session.activeRedactor = undefined;
         session.activeProvider = undefined;

package/dist/agent-session/session/provider-round.d.ts

@@ -1,6 +1,16 @@
 /** Provider-round phase of runInternal (plan 059). */
-import type { ProviderRequest, ProviderTurnResult, RunOptions, Usage } from "../../contracts.js";
+import type { ModelConfig, ProviderRequest, ProviderTurnResult, RunOptions, ToolResult, Usage } from "../../contracts.js";
 import type { RoundContext, SessionHost } from "./types.js";
-export declare function recordProviderUsage(ctx: RoundContext, turnUsage: Usage | undefined, turn: number, attempt: number): Promise<void>;
-export declare function generateWithRetry(session: SessionHost, request: ProviderRequest, runId: string, options: RunOptions, signal: AbortSignal, requestSecrets?: readonly (string | undefined)[], turn?: number, recordUsage?: (usage: Usage | undefined, turn: number, attempt: number) => Promise<void>): Promise<ProviderTurnResult>;
-export declare function generateProviderTurn(session: SessionHost, request: ProviderRequest, runId: string, signal: AbortSignal, secrets?: readonly (string | undefined)[], turn?: number, attempt?: number, recordUsage?: (usage: Usage | undefined, turn: number, attempt: number) => Promise<void>): Promise<ProviderTurnResult>;
+/** Resolve the per-request input cap for turn-budget metadata (plan 087 T1). A model without a
+ *  derivable cap (or a bad attention setting on an unrelated run) omits the field instead of
+ *  failing an emitting turn; the attention compiler, when enabled, is the cap authority. */
+export declare function resolveTurnInputCap(session: SessionHost, model: ModelConfig): number | undefined;
+export declare function recordProviderUsage(ctx: RoundContext, turnUsage: Usage | undefined, turn: number, attempt: number, request?: ProviderRequest): Promise<Usage | undefined>;
+/**
+ * Plan 096: host middleware may answer the turn deterministically at the `beforeProviderTurn` seam —
+ * no provider request, no usage, mandatory provenance. `undefined` sends the turn to the provider
+ * unchanged; a malformed answer fails the run closed instead of falling through to the provider.
+ */
+export declare function resolveDeterministicTurn(session: SessionHost, request: ProviderRequest, runId: string, turn: number, signal: AbortSignal, toolResults?: readonly ToolResult[]): Promise<ProviderTurnResult | undefined>;
+export declare function generateWithRetry(session: SessionHost, request: ProviderRequest, runId: string, options: RunOptions, signal: AbortSignal, requestSecrets?: readonly (string | undefined)[], turn?: number, recordUsage?: (usage: Usage | undefined, turn: number, attempt: number) => Promise<Usage | undefined>, toolResults?: readonly ToolResult[]): Promise<ProviderTurnResult>;
+export declare function generateProviderTurn(session: SessionHost, request: ProviderRequest, runId: string, signal: AbortSignal, secrets?: readonly (string | undefined)[], turn?: number, attempt?: number, recordUsage?: (usage: Usage | undefined, turn: number, attempt: number) => Promise<Usage | undefined>, toolResults?: readonly ToolResult[]): Promise<ProviderTurnResult>;

package/dist/agent-session/session/provider-round.js

@@ -1,9 +1,14 @@
 /** Provider-round phase of runInternal (plan 059). */
+import { resolveInputCap } from "../../attention-compiler.js";
+import { cacheUsageReport } from "../../cache-helpers.js";
+import { estimateMessageTokens } from "../../context-budget.js";
 import { assertGuardrailsAllowed, GuardrailError, runGuardrails } from "../../guardrails.js";
+import { validateDeterministicTurnAnswer } from "../../middleware.js";
 import { createProviderTurnMetadata, readProviderHttpStatus } from "../../observability.js";
-import { providerToolCallDeltaContent } from "../../provider-events.js";
+import { providerError, providerToolCallDeltaContent } from "../../provider-events.js";
 import { errorToErrorInfo, redactRunLedgerRecord, redactSecrets } from "../../redaction.js";
 import { createDefaultRetryPolicy, waitForRetry } from "../../retry.js";
+import { estimateTextTokensForFamily } from "../../usage-estimation.js";
 import { bridgeAbort, errorFromInfo, isSteerSoftInterrupt, jsonBytes, mergeRetry, ProviderTurnFailure, providerContent, randomId, reconstructMissingToolCalls, SteerSoftInterrupt, throwIfAborted, } from "../helpers.js";
 function pushCoalescedContent(content, block) {
     const last = content.at(-1);
@@ -21,6 +26,49 @@ function pushCoalescedContent(content, block) {
     }
     content.push(block);
 }
+/** Resolve the per-request input cap for turn-budget metadata (plan 087 T1). A model without a
+ *  derivable cap (or a bad attention setting on an unrelated run) omits the field instead of
+ *  failing an emitting turn; the attention compiler, when enabled, is the cap authority. */
+export function resolveTurnInputCap(session, model) {
+    const setting = session.agent.config.attentionCompiler;
+    const options = typeof setting === "object" && setting !== null ? setting : undefined;
+    try {
+        return resolveInputCap(options ? { maxInputTokens: options.maxInputTokens, reserveTokens: options.reserveTokens } : {}, model);
+    }
+    catch {
+        return undefined;
+    }
+}
+/** Effective budget snapshot at turn end (plan 087 T1): O(1) from the run limit tracker. */
+function turnBudgets(session, model, usage) {
+    const tracker = session.activeLimits;
+    if (!tracker)
+        return undefined;
+    const snapshot = tracker.snapshot();
+    const inputCap = resolveTurnInputCap(session, model);
+    const runInputBudget = tracker.limits.maxInputTokens;
+    return {
+        ...(usage?.inputTokens === undefined ? {} : { inputTokens: usage.inputTokens }),
+        ...(inputCap === undefined ? {} : { inputCap }),
+        ...(runInputBudget === null ? {} : { runInputBudget }),
+        runInputUsed: snapshot.inputTokens,
+        turns: snapshot.turns,
+        maxTurns: tracker.limits.maxTurns,
+    };
+}
+function cacheMetadata(usage) {
+    const cache = cacheUsageReport(usage);
+    return cache === undefined ? {} : { cache };
+}
+/** Native reason wins, except a generic `end_turn` on a turn that produced tool calls: protocols
+ *  with one generic completion value (Google `STOP`) are tool-call turns by content (plan 087 T1). */
+function normalizeTurnStopReason(native, calls) {
+    if (native === undefined)
+        return calls.length > 0 ? "tool_calls" : "end_turn";
+    if (native === "end_turn" && calls.length > 0)
+        return "tool_calls";
+    return native;
+}
 /**
  * Plan 062: price usage through the host's {@link CostCatalog} when the provider
  * did not report a cost itself. Stale/unknown quotes, catalog failures, or
@@ -46,17 +94,22 @@ async function withCatalogCost(catalog, model, usage, signal) {
         return usage; // catalog failure degrades to usage-only
     }
 }
-export async function recordProviderUsage(ctx, turnUsage, turn, attempt) {
+export async function recordProviderUsage(ctx, turnUsage, turn, attempt, request) {
     const { session, limits, runUsage, runId } = ctx;
-    const usage = turnUsage
-        ? await withCatalogCost(session.agent.config.costCatalog, ctx.model, turnUsage, ctx.controller.signal)
-        : undefined;
-    limits.recordUsage(usage);
-    if (!usage)
-        return;
-    runUsage.add(usage);
+    const usage = turnUsage ?? estimateTurnUsage(session, ctx.model, request);
+    // An estimate is never priced: a catalog quote on estimated tokens would invent billing.
+    const effective = usage && usage.estimated !== true
+        ? await withCatalogCost(session.agent.config.costCatalog, ctx.model, usage, ctx.controller.signal)
+        : usage;
+    limits.recordUsage(effective);
+    if (!effective)
+        return undefined;
+    if (effective.inputTokens !== undefined) {
+        session.activeInputMeter = { tokens: effective.inputTokens, source: effective.estimated === true ? "estimated" : "reported" };
+    }
+    runUsage.add(effective);
     if (!session.activeLedger)
-        return;
+        return effective;
     const usageRecord = {
         id: randomId("usage"),
         sessionId: session.id,
@@ -64,19 +117,111 @@ export async function recordProviderUsage(ctx, turnUsage, turn, attempt) {
         scope: "provider_turn",
         turn,
         attempt,
-        usage,
+        usage: effective,
         recordedAt: new Date().toISOString(),
         ...session.activeOwnership,
     };
     await session.activeLedger.appendUsage(redactRunLedgerRecord(usageRecord, session.activeRedactor));
+    return effective;
+}
+/**
+ * Plan 091 T2 missing-usage fallback: when the provider reported nothing and the
+ * agent did not turn estimation off, label an estimate of the turn's own request
+ * (messages + tool declarations + context blocks). Returns `undefined` when
+ * estimation is off or the request is unavailable — absent stays absent.
+ */
+function estimateTurnUsage(session, model, request) {
+    if (!request || session.agent.config.usageEstimation === "off")
+        return undefined;
+    const estimate = estimateMessageTokens(request.messages, model.model);
+    const extras = request.tools?.length || request.context?.length ? JSON.stringify({ tools: request.tools, context: request.context }) : undefined;
+    return {
+        inputTokens: estimate.tokens + (extras === undefined ? 0 : estimateTextTokensForFamily(extras, model.model)),
+        estimated: true,
+        confidence: estimate.confidence,
+    };
+}
+/** Latest user-role text in the assembled request; steered messages included. */
+function lastUserText(messages) {
+    for (let i = messages.length - 1; i >= 0; i -= 1) {
+        const message = messages[i];
+        if (message?.role !== "user")
+            continue;
+        return message.content.map((block) => (block.type === "text" ? block.text : "")).join("");
+    }
+    return "";
+}
+/**
+ * Plan 096: host middleware may answer the turn deterministically at the `beforeProviderTurn` seam —
+ * no provider request, no usage, mandatory provenance. `undefined` sends the turn to the provider
+ * unchanged; a malformed answer fails the run closed instead of falling through to the provider.
+ */
+export async function resolveDeterministicTurn(session, request, runId, turn, signal, toolResults = []) {
+    const middleware = session.agent.config.middleware;
+    if (!middleware)
+        return undefined;
+    const payload = await middleware.run("beforeProviderTurn", {
+        sessionId: session.id,
+        runId,
+        turn,
+        userText: lastUserText(request.messages),
+    });
+    const answer = payload?.answer;
+    if (answer === undefined)
+        return undefined;
+    const validated = validateDeterministicTurnAnswer(answer);
+    throwIfAborted(signal);
+    const messageId = randomId("msg");
+    // Same response-byte axis as provider output: a host answer must not bypass a run ceiling.
+    session.activeLimits?.charge("maxResponseBytes", jsonBytes(validated.content));
+    if (session.activeGuardrails?.output?.length) {
+        assertGuardrailsAllowed(await runGuardrails({
+            stage: "output",
+            guardrails: session.activeGuardrails,
+            value: { content: validated.content, calls: [], messageId, started: true, usage: undefined },
+            context: {
+                sessionId: session.id,
+                runId,
+                metadata: session.activeMetadata ?? {},
+                signal,
+                toolResults,
+            },
+            redactor: session.activeRedactor,
+            emit: (event) => session.emit(event),
+        }));
+    }
+    session.emit({
+        type: "deterministic_turn",
+        sessionId: session.id,
+        runId,
+        turn,
+        middleware: validated.provenance.middleware,
+    });
+    session.emit({
+        type: "message_started",
+        sessionId: session.id,
+        runId,
+        message: { id: messageId, role: "assistant", content: [] },
+    });
+    for (const block of validated.content)
+        session.emit({ type: "message_delta", sessionId: session.id, runId, content: block });
+    // Provenance rides the message into the store (plan 096 Task 2): the transcript alone proves no model ran.
+    return {
+        content: validated.content,
+        calls: [],
+        messageId,
+        started: true,
+        usage: undefined,
+        metadata: { deterministic: validated.provenance },
+    };
 }
-export async function generateWithRetry(session, request, runId, options, signal, requestSecrets = [], turn = 1, recordUsage) {
+export async function generateWithRetry(session, request, runId, options, signal, requestSecrets = [], turn = 1, recordUsage, toolResults = []) {
     const retry = mergeRetry(session.agent.config.retry, options.retry);
     const secrets = [...requestSecrets, ...(retry?.secrets ?? [])];
     const policy = retry?.policy ?? (retry ? createDefaultRetryPolicy(retry) : undefined);
     for (let attempt = 1;; attempt += 1) {
         try {
-            return await generateProviderTurn(session, request, runId, signal, secrets, turn, attempt, recordUsage);
+            return await generateProviderTurn(session, request, runId, signal, secrets, turn, attempt, recordUsage, toolResults);
         }
         catch (error) {
             if (error instanceof GuardrailError || isSteerSoftInterrupt(error))
@@ -100,7 +245,7 @@ export async function generateWithRetry(session, request, runId, options, signal
         }
     }
 }
-export async function generateProviderTurn(session, request, runId, signal, secrets = [], turn = 1, attempt = 1, recordUsage) {
+export async function generateProviderTurn(session, request, runId, signal, secrets = [], turn = 1, attempt = 1, recordUsage, toolResults = []) {
     session.activeLimits.charge("maxProviderAttempts");
     session.activeLimits.charge("maxRequestBytes", jsonBytes(request));
     const startedAt = performance.now();
@@ -119,7 +264,9 @@ export async function generateProviderTurn(session, request, runId, signal, secr
     let messageId;
     let started = false;
     let usage;
+    let nativeStopReason;
     let usageRecorded = false;
+    let effectiveUsage;
     const bufferedOutput = [];
     const bufferOutput = Boolean(session.activeGuardrails?.output?.length || session.activeLimitOutputBuffer);
     const emitOutput = (event) => {
@@ -130,9 +277,11 @@ export async function generateProviderTurn(session, request, runId, signal, secr
     };
     const recordTurnUsage = async () => {
         if (usageRecorded)
-            return;
+            return effectiveUsage;
         usageRecorded = true;
-        await recordUsage?.(usage, turn, attempt);
+        // The seam may return a labeled estimate (plan 091 T2); without a callback the reported value stands.
+        effectiveUsage = (await recordUsage?.(usage, turn, attempt)) ?? usage;
+        return effectiveUsage;
     };
     const turnAbort = new AbortController();
     const cleanupTurn = bridgeAbort(signal, turnAbort);
@@ -153,6 +302,7 @@ export async function generateProviderTurn(session, request, runId, signal, secr
                 usage = event.usage;
             if (event.type === "done") {
                 usage = event.usage ?? usage;
+                nativeStopReason = event.stopReason;
                 break;
             }
             if (event.type === "message_start") {
@@ -189,7 +339,13 @@ export async function generateProviderTurn(session, request, runId, signal, secr
                 stage: "output",
                 guardrails: session.activeGuardrails,
                 value: { content, calls, messageId, started, usage },
-                context: { sessionId: session.id, runId, metadata: session.activeMetadata ?? {}, signal: turnAbort.signal },
+                context: {
+                    sessionId: session.id,
+                    runId,
+                    metadata: session.activeMetadata ?? {},
+                    signal: turnAbort.signal,
+                    toolResults,
+                },
                 redactor: session.activeRedactor,
                 emit: (event) => session.emit(event),
             }));
@@ -203,10 +359,15 @@ export async function generateProviderTurn(session, request, runId, signal, secr
             sessionId: session.id,
             runId,
             turn,
-            metadata: buildMetadata({ latencyMs }),
-            usage,
+            metadata: buildMetadata({
+                latencyMs,
+                stopReason: normalizeTurnStopReason(nativeStopReason, calls),
+                budgets: turnBudgets(session, request.model, effectiveUsage),
+                ...cacheMetadata(effectiveUsage),
+            }),
+            usage: effectiveUsage,
         });
-        return { content, calls, messageId, started, usage };
+        return { content, calls, messageId, started, usage: effectiveUsage };
     }
     catch (error) {
         if (isSteerSoftInterrupt(error) || isSteerSoftInterrupt(turnAbort.signal.reason)) {
@@ -217,21 +378,32 @@ export async function generateProviderTurn(session, request, runId, signal, secr
                 sessionId: session.id,
                 runId,
                 turn,
-                metadata: buildMetadata({ latencyMs }),
-                usage,
+                metadata: buildMetadata({
+                    latencyMs,
+                    stopReason: "abort",
+                    budgets: turnBudgets(session, request.model, effectiveUsage),
+                    ...cacheMetadata(effectiveUsage),
+                }),
+                usage: effectiveUsage,
             });
             throw new SteerSoftInterrupt();
         }
         const latencyMs = Math.round(performance.now() - startedAt);
-        const info = error instanceof ProviderTurnFailure ? redactSecrets(error.info, secrets) : errorToErrorInfo(error, secrets);
+        const info = error instanceof ProviderTurnFailure ? redactSecrets(error.info, secrets) : providerError(error, secrets).error;
         await recordTurnUsage();
         session.emit({
             type: "provider_turn_finished",
             sessionId: session.id,
             runId,
             turn,
-            metadata: buildMetadata({ latencyMs, httpStatus: readProviderHttpStatus(info) }),
-            usage,
+            metadata: buildMetadata({
+                latencyMs,
+                httpStatus: readProviderHttpStatus(info),
+                stopReason: signal.aborted || turnAbort.signal.aborted ? "abort" : "provider_error",
+                budgets: turnBudgets(session, request.model, effectiveUsage),
+                ...cacheMetadata(effectiveUsage),
+            }),
+            usage: effectiveUsage,
             error: info,
         });
         if (error instanceof GuardrailError || error instanceof ProviderTurnFailure)

package/dist/agent-session/session/tool-round.js

@@ -238,6 +238,24 @@ export function bindChargeToolRound(ctx) {
         }
     };
 }
+/** Last-N dispatched tool calls kept for `budget_exhausted` attribution (plan 087 T2); the hash
+ *  is the same canonical arguments hash the effect store uses, so raw args never enter events. */
+const RECENT_TOOL_CALL_LIMIT = 10;
+function recordRecentToolCall(session, call) {
+    const recent = (session.activeRecentToolCalls ??= []);
+    recent.push({ id: call.id, name: call.name, argHash: `sha256:${toolEffectArgumentsHash(call.arguments)}` });
+    if (recent.length > RECENT_TOOL_CALL_LIMIT)
+        recent.shift();
+}
+function dispatchFilter(ctx) {
+    const hiddenOk = ctx.options.allowHiddenToolCalls ?? ctx.session.agent.config.allowHiddenToolCalls;
+    if (hiddenOk || ctx.turnAllow === undefined) {
+        return ctx.tools.length > 0 ? { filter: { allow: ctx.tools.map((tool) => tool.name) } } : {};
+    }
+    if (ctx.turnAllow.length > 0)
+        return { filter: { allow: ctx.turnAllow } };
+    return ctx.tools.length > 0 ? { filter: { deny: ctx.tools.map((tool) => tool.name) } } : {};
+}
 export function bindDispatchToolCall(ctx) {
     return async (call) => {
         const sticky = matchStickyDecision(ctx.session, call, ctx.registry);
@@ -251,8 +269,10 @@ export function bindDispatchToolCall(ctx) {
         if (ctx.session.activeGatedRound?.has(call.id)) {
             return { toolCallId: call.id, name: call.name, metadata: { approvalPending: true } };
         }
+        ctx.toolCalls += 1;
+        recordRecentToolCall(ctx.session, call);
         try {
-            return await dispatchToolCall({
+            const result = await dispatchToolCall({
                 call,
                 registry: ctx.registry,
                 context: {
@@ -278,7 +298,7 @@ export function bindDispatchToolCall(ctx) {
                 ownership: ctx.session.activeOwnership,
                 identity: ctx.session.activeIdentity,
                 guardrails: ctx.session.activeGuardrails,
-                ...(ctx.tools.length > 0 ? { filter: { allow: ctx.tools.map((tool) => tool.name) } } : {}),
+                ...dispatchFilter(ctx),
                 limitTracker: ctx.limits,
                 beforeExecute: async (mediatedCall) => {
                     const durable = ctx.session.activeDurable;
@@ -329,6 +349,8 @@ export function bindDispatchToolCall(ctx) {
                 },
                 validate: ctx.validate,
             });
+            ctx.toolResults.push(result);
+            return result;
         }
         catch (error) {
             if (error instanceof AgentDelegationSuspendedError && !error.toolCall)

package/dist/agent-session/session/types.d.ts

@@ -1,8 +1,8 @@
 /** Shared host/round types for runInternal phase split (plan 059). Internal only. */
 import type { ActiveDurableRun } from "../../agent-approval.js";
 import type { PendingToolCall } from "../../agent-run-state.js";
-import type { AttentionStickyFrontier, PersistedAttentionStickyFrontier } from "../../attention-compiler.js";
-import type { Agent, AgentEvent, AgentLoopStrategy, AgentRunResult, AIProvider, ErrorInfo, Guardrails, LoopContext, Message, ModelConfig, OwnershipScope, PendingDecision, PromptVersionRef, ProviderRequest, RunLedger, RunOptions, SessionEntry, SessionStore, Skill, ToolDefinition, ToolEffectStore, ToolRegistry, Usage } from "../../contracts.js";
+import type { AttentionFoldLedger, AttentionStickyFrontier, PersistedAttentionFoldLedger, PersistedAttentionStickyFrontier } from "../../attention-compiler.js";
+import type { Agent, AgentEvent, AgentFinishReason, AgentLoopStrategy, AgentRunResult, AIProvider, ErrorInfo, Guardrails, LoopContext, Message, ModelConfig, OwnershipScope, PendingDecision, PromptVersionRef, ProviderRequest, RunLedger, RunOptions, SessionEntry, SessionStore, Skill, ToolCallSummary, ToolDefinition, ToolEffectStore, ToolRegistry, ToolResult, Usage } from "../../contracts.js";
 import type { AgentIdentity } from "../../identity.js";
 import type { AgentInput } from "../../input.js";
 import type { SecretRedactor } from "../../redaction.js";
@@ -33,9 +33,19 @@ export type SessionHost = {
     activeIdentity?: AgentIdentity;
     activeIdempotencyKey?: string;
     activeGuardrails?: Guardrails;
+    /** Plan 092 Task 2: packs compiled once at session construction; read-only for phases. */
+    readonly packGuardrails?: Guardrails;
     activeMetadata?: Readonly<Record<string, unknown>>;
     activePromptVersion?: PromptVersionRef;
     activeLimits?: RunLimitTracker;
+    /** Plan 091 T2: input tokens of the latest provider turn plus whether the
+     *  provider reported them. Set by the usage seam; read by `contextMeter()`. */
+    activeInputMeter?: {
+        readonly tokens: number;
+        readonly source: "reported" | "estimated";
+    };
+    /** Bounded last-N tool-call summaries of the active run (plan 087 T2): ids, names, arg hashes. */
+    activeRecentToolCalls?: ToolCallSummary[];
     activeLimitOutputBuffer: boolean;
     activeDurable?: ActiveDurableRun;
     activeLoop?: AgentLoopStrategy;
@@ -45,6 +55,8 @@ export type SessionHost = {
     }>;
     activeLoopTurn: number;
     readonly loadedSkills: LoadedSkillSet;
+    /** Run-owned monotonic prompt tail; cleared before each new run. */
+    readonly tailSegments: Map<string, Message>;
     readonly activatedTools: ActiveToolSet;
     restoredSkillBodies: readonly LoadedSkillBodiesEntry[];
     activeRunSkills: readonly Skill[];
@@ -57,6 +69,15 @@ export type SessionHost = {
     serializedAttentionSticky(): PersistedAttentionStickyFrontier | undefined;
     /** Plan 074 P3: restore a frontier that was validated when the checkpoint was loaded. */
     restoreAttentionSticky(persisted: PersistedAttentionStickyFrontier): void;
+    /** Folded bodies for this session (plan 086 T3); session-owned so a resumed fold re-applies
+     *  the same stub bytes instead of calling the host `summarize` again. Lazily created. */
+    attentionFoldFor(): AttentionFoldLedger;
+    /** Plan 086 T3: bounded ledger snapshot for a durable checkpoint (undefined before any fold). */
+    serializedAttentionFold(): PersistedAttentionFoldLedger | undefined;
+    /** Plan 086 T3: adopt a ledger validated when the checkpoint was loaded. */
+    restoreAttentionFold(ledger: AttentionFoldLedger): void;
+    /** Plan 086 T3: `attention.compiler.durable` for the current run; set by the run assembler. */
+    attentionDurable: boolean;
     invalidateSnapshot(): void;
     resolveRunProvider(options: RunOptions): void;
     emit(event: AgentEvent): void;
@@ -87,6 +108,11 @@ export type SessionHost = {
     snapshot(): Promise<SessionContextSnapshot>;
 };
 export declare function asSessionHost(session: unknown): SessionHost;
+/** Why a run's loop ended, plus the host's stop detail when `RunOptions.turnPolicy` stopped it. */
+export type RunStopInfo = {
+    readonly reason: AgentFinishReason;
+    readonly detail?: string;
+};
 export type RoundContext = {
     session: SessionHost;
     input: AgentInput;
@@ -111,12 +137,20 @@ export type RoundContext = {
     loop: AgentLoopStrategy;
     toolConcurrency: number;
     toolsDisclosure: import("../../tool-search.js").ToolsDisclosure;
+    /** Per-turn dispatch overlay; undefined when `toolNarrowing` is unset. */
+    turnAllow?: readonly string[];
     assembledTurn: boolean;
     artifactFinished: boolean;
     artifactFailedInfo: {
         message: string;
         code?: string | number;
     } | undefined;
+    /** Host tool calls dispatched in this run; the turn-boundary context's `toolCalls` (plan 084 Task 2). */
+    toolCalls: number;
+    /** Completed host tool results from this run, for output evidence guardrails (plan 084 Task 5). */
+    toolResults: ToolResult[];
+    /** Set when a `RunOptions.turnPolicy` stop ended the loop (plan 084 Task 2). */
+    runStop?: RunStopInfo;
     runUsage: {
         add(usage: Usage): void;
         value(): Usage | undefined;